7.2 Organizational structure

The organizational structure of the risk management system is consistent across the PZU Group and in the PZU Group’s various financial sector entities consists of four competence levels.

The first three are:

• The Supervisory Board, which supervises the risk management process and assesses its adequacy and effectiveness as part of its decision-making powers defined in each company’s Articles of Association and the Supervisory Board bylaws;
• The Management Board, which organizes the risk management system and ensures that it is operational, by adopting strategies and policies, setting the level of risk appetite, defining the risk profile and tolerance levels for individual categories of risk;
• committees, which make decisions to mitigate individual risks to a level determined by the risk appetite. The committees adopt the procedures and methodologies for mitigating individual risks and accept individual risk limits.

The fourth decision-making level pertains to operational measures and is divided into three lines of defense:

• the first line of defense includes ongoing risk management at the business unit and organizational unit level and decision- making as part of the risk management process;
• the second line of defense includes risk management by specialized cells responsible for risk identification, measurement, monitoring and reporting and controlling the limits;
• the third line of defense includes the internal audit division that conducts independent audits of individual components of the risk management system as well as of control activities embedded in the Group’s operations.

In the risk management process in banks (Pekao and Alior Bank), an active role is played by Management Board, Supervisory Boards and special committees dealing with credit, financial and operating risk as well as asset and liability management.

Supervisory Boards oversee the risk management process and set out a relevant strategy each year. Management Boards are responsible, among others, for accepting policies and guidelines related to risk management and for setting detailed limits to mitigate bank risk and provide adequate control mechanisms.

Special committees exercise ongoing control over the bank’s risk management, which includes decisions about the accepted level of credit risk for single transactions, recommendations of portfolio limits for credit risk to the Management Board, supervision of liquidity risk level, market risk limits and the allowed level of operational risk. In addition, they monitor the risk appetite and capital adequacy levels.